Abstract: Disclosed herein is a system for determining scores that are usable to filter a larger set of metrics (e.g., thousands of metrics) down to a smaller set of relevant metrics (e.g., hundreds of metrics) that can be more efficiently queried and ingested for root-cause analysis of an incident. During a training stage, the system analyzes known incidents and converts the names of the metrics, as described via customer-defined words, into mathematical representations (e.g., word embedding featurization vectors). When a new metric with a new name is received for a new incident, the system implements an incident inference stage during which the new name is converted into a new mathematical representation. The system compares the new mathematical representation to the mathematical representations to identify a similar mathematical representation. The system retrieves the score for the metric associated with the similar mathematical representation and assigns the retrieved score to the new metric.

Abstract: The disclosure relates to utilizing an anomaly mitigation proposal system to determine root causes, summarize anomalous metrics, and report mitigation actions for service incidents in cloud computing systems. Based on receiving an incident report request, the anomaly mitigation proposal system utilizes a two-layer approach that implements large generative language models to generate incident reports that include clear and concise text narratives summarizing metric anomalies, root causes, and corresponding mitigation actions. For example, the anomaly mitigation proposal system initially utilizes an online generative language model to provide these incident reports and, when unavailable within a time threshold, a fallback model that references root cause datastores.

Abstract: The disclosure relates to utilizing a service incident resolution system to determine and mitigate service incidents in a cloud computing system. For example, based on identifying an outage ticket (e.g., a customer-impacting incident ticket), the service incident resolution system identifies additional context of the outage by detecting a number of relevant monitoring signals. For instance, the service incident resolution system utilizes various monitoring signals and service models to determine monitoring signals that are relevant to the outage ticket by efficiently selecting relevant monitor signals and filtering out noisy signals. In this way, vaguely reported outages are supplemented with rich information that enable these outages to be resolved more quickly. Additionally, the service incident resolution system may utilize service-based models to efficiently send a report of an outage to a service or mitigation team that is well-equipped to quickly address the outage.

Abstract: Systems and methods for service incident detection in a cloud computing platform. According to an example implementation, the incident detection system retrieves a single user metric corresponding to a service call to a resource on which the service is dependent and uses unsupervised anomaly detection to detect anomalies indicative of a service incident. Detected anomalies include an anomaly score indicating a level of anomality. Additionally, a supervised learning classifier is trained and used to filter/classify the anomaly detection results based on features corresponding to the anomaly score. The features are learned based on characteristic dimensions, distribution, and statistics of anomaly scores of the user metric at different resolution/aggregation levels. Anomaly detection results are classified as an incident or not an incident. A report is generated for a determined incident.